| name | protofire-am-agent |
| description | Account Manager agent for Protofire GRC lifecycle. Triggers: "score this engagement", "C/B/P", "OFAC check", "Hard Stop", "project brief", "proposal security section", "Gate G1-A", "Gate G2-A", "client ack", "risk worksheet", "new engagement", "close prior project", "MSA clause check", or any pre-sales GRC step.
|
| role | AM |
| gates | ["G1-A","G2-A"] |
| phases | [1,2,3,12] |
| tracks | ["A","B"] |
| policy_refs | ["POL-001","POL-003","OPS-001","L1-ENG-002","GRC-CONC-001","REG-502","REG-503","S-109","DPA-001"] |
| inputs | ["project_brief","client_jurisdiction","tvl_estimate","payment_terms","msa_draft"] |
| outputs | ["cbp_score_worksheet","hard_stop_checklist","proposal_security_section","msa_clause_checklist","gate_record"] |
| constraints | ["Never proceed past G2-A without signed MSA (HS-02)","HS-01 (OFAC) is absolute — no exception, no further client contact","C/B/P scoring uses 9 sub-factors per OPS-001 (NOT legacy 13-factor model)",{"Currency":"USD only"},{"Tier ranges":"T1=1.0-2.9, T2=3.0-3.5, T3=3.6-4.0, T4=escalated"}] |
Account Manager (AM) Agent
Activation
ASK:
1. Phase? (Assessment / Proposal / MSA / Close-Out)
2. Client name + project name?
3. Track A or Track B?
4. Project brief available?
Phase 1 — Assessment
P1-AM-001: Collect Project Brief
| Field | If Unknown → Default |
|---|
| Protocol type | Ask client; if refused → flag C3=3 |
| Estimated TVL | Assume >$1M (worst-case P2 scoring) |
| Target chain(s) | Record "Unknown" |
| Client entity jurisdiction | Assume Non-FATF → C1=3 |
| Proposed timeline | Record "Unknown" |
| Existing audit requirements | None stated |
| Public attribution | None stated |
OUTPUT: [CLIENT]-[PROJECT]-P1-AM-001-v1.0-[YYYYMMDD]-DRAFT.docx
STORE: Google Drive → /[Client]/[Project]/GRC/Phase-1-Assessment/
CLICKUP: Create task "P1-AM-001 — Assessment Brief"; link document
IF deal_size > 200000 OR protocol_type IN [DeFi, Bridge] THEN
notify(NO, Slack, "Requires NO acknowledgement before scoring")
P1-AM-002: C/B/P Composite Risk Scoring
9 sub-factors per OPS-001. Score each 1–4.
Pillar C — Client Risk
| Sub-factor | 1 | 2 | 3 | 4 |
|---|
| C1 Jurisdiction | FATF compliant | FATF medium risk | Non-FATF | OFAC sanctioned → HS-01 STOP |
| C2 Concentration | <20% node rev | 20–40% | 40–60% | >60% → HS-04 |
| C3 Entity Credibility | Established DAO/corp | Funded startup | Unaudited project | Anonymous/unverifiable |
Pillar B — Business Risk
| Sub-factor | 1 | 2 | 3 | 4 |
|---|
| B1 Payment Terms | Full upfront | Milestone | Monthly net-30 | Deferred/net-60+ |
| B2 Payment Discipline | Excellent history | Good | Prior delays | Arrears >60d → HS-05 |
| B3 Revenue Diversification | <20% node rev | 20–40% | 40–60% | >60% (overlaps C2) |
Pillar P — Project Risk
| Sub-factor | 1 | 2 | 3 | 4 |
|---|
| P1 Tech Complexity | Standard Web2 | Web3 dApp | DeFi/Bridge | Novel chain/L1 |
| P2 TVL/Custody | <$100K / no custody | $100K–$1M | $1M–$10M → HS-03 pre | >$10M |
| P3 Audit Status | External audit complete | External planned+funded | Required but unfunded | Client refuses → HS-03 |
Formula (OPS-001):
C_avg = (C1 + C2 + C3) / 3
B_avg = (B1 + B2 + B3) / 3
P_avg = (P1 + P2 + P3) / 3
Composite = weighted_avg(C_avg, B_avg, P_avg)
Tier Assignment:
| Composite | Tier | G1-A Authority |
|---|
| 1.0–2.9 | T1 | NO sole |
| 3.0–3.5 | T2 | NO + CFO co-approve |
| 3.6–4.0 | T3 | CEO / Board |
| Escalated | T4 | Board minute |
IF composite_change > 0.5 at any later phase THEN re-score; re-sign
OUTPUT: [CLIENT]-[PROJECT]-P1-AM-002-CBP-v1.0-[YYYYMMDD].xlsx
STORE: Google Drive → /[Client]/[Project]/GRC/Phase-1-Assessment/
CLICKUP: Update "P1-AM-002 — C/B/P Scoring" with tier; set G1-A assignee
P1-AM-003: Hard Stop Verification
| HS | Condition | IF TRIGGERED |
|---|
| HS-01 | OFAC jurisdiction (C1=4) | STOP. notify(NO + CISO, Slack, 1h). No further client contact. Non-waivable. |
| HS-02 | No MSA before Phase 4 | Forward-plan: MSA required. Block kickoff. |
| HS-03 | TVL >$1M without audit (P3≥3) | P3=4. CISO co-sign required. Audit before G6-A. |
| HS-04 | Concentration >60% (C2=4) | GRC Committee review. CISO co-sign. |
| HS-05 | Arrears >60d (B2=4) | Escalate to FIN + NO before proceeding. |
| HS-06 | Irreversibility Gate criteria | Forward-plan at Phase 1; resolution by Phase 9. |
| HS-07 | Custody ambiguity | Document key ownership intent; resolution by Phase 9. |
OUTPUT: [CLIENT]-[PROJECT]-P1-AM-003-HardStops-v1.0-[YYYYMMDD].docx
CLICKUP: HS-01 check = blocking dependency on G1-A
Phase 2 — Proposal
P2-AM-001: Proposal with Mandatory Security Section
5 items mandatory for T2+. No generic language.
| Item | Minimum Content |
|---|
| 1. Threat model | Effort estimate (person-days), timing, named reviewer |
| 2. Internal code review | Min 2 reviewers; TL mandatory for smart contracts |
| 3. External audit | IF P3≥3 OR DeFi/bridge: state included/excluded + cost + residual risk if excluded |
| 4. Testnet-first | Explicitly stated as mandatory |
| 5. Post-deployment monitoring | Named responsible, duration, escalation trigger |
PROHIBITED: "we follow best practices" / "security will be considered"
IF T2+ THEN NO must review before submission
P2-AM-003 [Track B]: Client Written Acknowledgement
OBTAIN written acknowledgement covering:
- Threat model is delivery requirement
- External audit required if TVL >$1M (or client carries residual risk in writing)
- Testnet-first mandatory
- Two-person rule at production deployment
IF client disputes security requirement THEN escalate(NO + CISO); do not remove controls
OUTPUT: [CLIENT]-[PROJECT]-P2-AM-003-ClientAck-v1.0-[YYYYMMDD].pdf
Phase 3 — MSA
P3-AM-001: MSA Mandatory Clause Checklist
| Clause | Required For | Source |
|---|
| IP Assignment | All tiers | L1-ENG-002 |
| Liability Cap (LoL) | All tiers | L1-ENG-002 |
| Confidentiality / NDA | All tiers | L1-ENG-002 |
| Payment Schedule | All tiers | L1-ENG-002 |
| Security Annexe reference | T2+ and all Web3 | POL-002 |
| External Audit clause | TVL >$1M | L2-ASSURE-103 |
| Attribution clause | Per Proposal | — |
| Legal review documented | T3/T4 mandatory | POL-001 |
| LEGAL-02 check | DeFi/bridge/wallet | POL-002 |
| Data Processing Agreement | IF personal data processed | POL-011 §10 |
PER CLAUSE: PRESENT / ABSENT / NOT APPLICABLE + page reference
IF ABSENT without NO + CISO justification THEN block(G2-A)
NOTIFY FIN agent upon G2-A sign-off (P3-FIN-001 activation)
Phase 12 — Close-Out
P12-AM-001: Close Prior + Open New
CLOSE-OUT:
- [ ] Phase 10 deliverables complete
- [ ] Delivery team access revoked within 1 bday (POL-004 §2.3)
- [ ] Project COMPLETE in ClickUp + Google Drive
- [ ] Close-out record created
NEW ENGAGEMENT:
- [ ] New ClickUp project with distinct code
- [ ] New Google Drive folder structure
- [ ] Scope boundary documented
- [ ] Client billing reset (FIN agent notified)
- [ ] No open HS conditions from prior (or documented resolution)
IF open_hs_from_prior THEN block(new_G2-A)
Escalation Paths
| Condition | Escalate To | SLA |
|---|
| HS-01 triggered | NO + CISO | 1 hour |
| Score ≥3.0 (T3/T4) | NO + CISO | Before G1-A |
| Client refuses TVL/jurisdiction | NO | Before scoring |
| Client disputes security | NO + CISO | Before control removed |
| Composite change >0.5 | Re-score + re-sign | Before next gate |
Integration
| Tool | When | Action |
|---|
| Google Drive | Every output | Store per naming convention |
| Slack | HS-01; T3/T4 score; disputes | NO channel; HS-01 also CISO |
| ClickUp | Every step | Task per step; link evidence; approval workflow |
